Integration Guides

LangChain

Wrap your chain with a Cyphrex check before calling the LLM or tools. Use a custom callback or middleware that invokes cyphrex.check() with actionType: 'llm_response' or 'tool_use' and the relevant payload.

CrewAI

Add a pre-step to each task that calls Cyphrex with the task type and target (e.g. URL or tool name). Block task execution if result.allowed === false.

OpenAI Assistants

Use the Assistants API run lifecycle: before executing a tool call or message, call cyphrex.check() with the tool name and arguments. Cancel the run if the check fails.

AutoGPT

Integrate in the action execution layer: before running any command or API call, pass the action to Cyphrex. Only proceed when allowed is true.

Custom agent frameworks

Call check() at the point where your agent is about to perform an action. Map your internal action types to Cyphrex actionType and include url and payload as needed. Enforce allowed before proceeding.

Security Best Practices

What Cyphrex stores

Cyphrex records action metadata: agent, action type, URL, result, violation details, spend and timestamp. Action payloads are not retained by default. The payload field is evaluated in memory for prompt injection and policy matching, then discarded. Payload retention can be enabled per agent for debugging, in which case up to 2048 characters are stored for the duration of your log retention window. Structured violation summaries generated by Cyphrex are always retained, as they contain no caller-supplied content.

API key security

API keys are shown once at generation or rotation and never again. The dashboard displays only the last 4 characters. Store your key immediately in a secrets manager or environment variable. If you lose it, rotate from API Keys in the dashboard.

Never expose keys client-side. Keys must only be used in server-side or backend environments. Never commit them to version control.

Rotate keys regularly. Revoke compromised keys immediately from the dashboard.

Behavior profiles

Set the minimum required permissions for each agent. Restrict URLs to known domains. Restrict action types to what the agent actually needs. Never use a wildcard allowlist in production.

Monitor and alert

Configure P1 alerts for critical violations. Review the audit log weekly for unexpected patterns. Use the MCP Threats page to monitor tool call security.

Team access

Use the Viewer role for anyone who only needs to read reports. Use Member for engineers who need to manage agents. Reserve Admin for founders and leads only.

Platform security

Cyphrex enforces rate limiting on all auth endpoints. Login attempts are limited to 5 per 15 minutes per IP. All API responses use security headers including Strict-Transport-Security, X-Content-Type-Options, and X-Frame-Options. All resource access is account-scoped. Team members can only access resources belonging to their company account.

Plans & Limits

Plan comparison

Core includes one vertical framework pack, hourly Merkle anchoring, and signed evidence packages. Scale includes all four packs, five minute anchoring, named DPA and signed BAA. Enterprise is scoped per deployment.

Rate limits

Rate limits are applied per plan tier. Excessive burst traffic may be throttled. See the dashboard for current usage.

Overage

If you exceed your plan's enforced-action limit, requests may be blocked. Let's talk about a higher plan.

Moving between plans

Paid plans are onboarded directly. See Plans.

Incident Response

What constitutes a security incident

Any unauthorized access to customer agent data, audit logs, compliance reports, API keys, or behavior profiles. Any breach of Cyphrex platform infrastructure.

Detection

Sentry monitors all API errors and exceptions in real time. Railway provides infrastructure-level alerting. Supabase provides database access logs. Joanna Martel (founder) is the primary on-call contact at all times.

Response timeframes

• Detection to internal assessment: 1 hour
• Customer notification of confirmed breach: within 24 hours
• HIPAA-covered customers: written notification within 48 hours
• Full incident report to affected customers: within 7 days of resolution

Notification

Affected customers are notified directly by email to the account owner from hello@cyphrex.io with a description of what was accessed, when, what was done to contain it, and what remediation steps were taken.

Containment steps

• Immediately revoke all affected API keys
• Rotate Supabase service role key
• Isolate affected accounts
• Preserve all logs for forensic analysis
• Patch the vulnerability before restoring service

Subprocessors

Supabase (database and auth), Railway (compute), Resend (email), Sentry (error monitoring), Solana (blockchain anchoring). Each maintains their own security programs and incident response procedures.

Contact

Report security issues to hello@cyphrex.io. Platform status at status.cyphrex.io.

Platform Security

Infrastructure

Cyphrex runs on Railway (compute) and Supabase (database and auth). All data is stored in the United States. Tenant isolation is enforced in the API layer: every route is account-scoped and ownership is checked before any resource is returned. Row-level security policies are additionally enabled on customer tables.

Authentication

Cyphrex supports email and password authentication and GitHub OAuth. Passwords are handled by Supabase Auth and are never stored by Cyphrex in plaintext. JWT tokens use the ES256 algorithm; tokens presenting insecure algorithms such as alg: none are rejected at the API layer.

API keys

API keys are hashed with SHA-256 before storage. The plaintext key is shown once at generation and never again. Comparison uses constant-time equality to prevent timing attacks. Keys can be rotated at any time from the dashboard by an account admin.

Rate limiting

All auth endpoints are rate limited. Login attempts are capped at 5 per 15 minutes per IP. API key rotation is capped at 3 per hour per account. Global API rate limiting applies to all routes.

Transport security

All traffic is served over HTTPS with HSTS enabled. Security headers including X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, and Referrer-Policy are set on all responses.

Data isolation

Every API route enforces account-scoped access. Team members can only access resources belonging to their company account. Administrative actions including API key rotation, billing and team management are restricted to account admins.

Status

Platform uptime is monitored and published at status.cyphrex.io.